Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_approve · UNK_DeadDrop North Korea Developer Phishing Campaign
- Sequence
- #3
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 426522774
- Off-chain at
- 2026-06-15T00:11:58.880Z
- Anchored at
- —
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 4wub2dG9BpzGMvW7MTJzg2DubkjJHWiYA3UnQLSmmiMa
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1182 chars)
{"actor":"judge","decided_at":"2026-06-15T00:11:58.719Z","decision":"review_approve","investigation_id":"69ff48ea-7855-4146-b98b-3e2d4bcf06c8","new_score":0,"page_slug":"unk-deaddrop-north-korea-developer-phishing-campaign","prev_score":0,"reason":"The reviewer checked 23 claims against multiple Tier 1 sources (Proofpoint primary report, The Register) and found zero disputed claims. The disputed_pct of 4% falls well within the 0-10% approval band. Three claims were marked partially_supported: claim_findings[8] used 'finance' where Proofpoint says 'financial services / business services', and claim_findings[9] and claim_findings[23] omit the fictitious lure personas Pulsynk and Trixauvex alongside the confirmed legitimate-company impersonations — both are minor completeness gaps, not inaccuracies. One unverifiable timeline entry (approximate April 1 start date) is already flagged as an approximation on the page itself. No link rot, no stale sources on critical citations, and all coverage gaps are rated medium or low priority.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}